Privacy policy

Last updated: May 4, 2026

01. Introduction

Agence Alivro Inc. ("we", "our", "us") is committed to protecting the personal information of our clients, prospects, and visitors. This policy describes what we collect, why, how it is used and shared, how long it is retained, and the rights you have.

This policy is compliant with:

• Quebec's Law 25 (Act respecting the protection of personal information in the private sector, as modernized in 2021)
• The federal PIPEDA (Personal Information Protection and Electronic Documents Act)
• CASL (Canada's Anti-Spam Legislation), governing all commercial electronic messages

By using our website or communicating with us, you acknowledge that you have read this policy.

02. Who we are

• Legal entity: Agence Alivro Inc.
• Address: 4885 Aut. 440, Laval, QC H7P 4W6
• Privacy officer: Matthieu Ruyssers, President
• Email: privacy@alivro.ca
• Phone: 514-975-0075

For any question, access request, correction, or deletion request concerning your personal information, contact the privacy officer above directly.

03. Information we collect

Depending on how you interact with us, we may collect:

• Identity information: first name, last name, preferred language
• Contact information: email, phone (optional), company name
• Inquiry details: call topic, context you choose to provide when booking, time zone
• Communications: emails exchanged with our team
• Web analytics: aggregated, anonymized statistics about pages visited (see §9 Cookies)
• Marketing preferences: consent or withdrawal for promotional communications

We never collect more information than necessary for the stated purpose.

04. Why we collect it

We use your personal information only for:

1. Preparing and holding a discovery call with you, at your request
2. Communicating with you about your inquiry, our offering, and the follow-up of any engagement
3. Legal compliance: tax, regulatory, and accounting obligations
4. Service improvement: aggregated, anonymized analysis of web traffic
5. Marketing communications: only with your prior explicit consent, in accordance with CASL (see §11)

05. Sharing data with third parties

We never sell your personal information. We share it only with service providers ("sub-processors") that need it to perform their functions on our behalf, and only to the extent necessary.

Our direct sub-processors

06. Cross-border transfers

Some of our sub-processors (notably Cal.com, Google Workspace, and Vercel) process information in the United States. Pursuant to article 17 of Law 25, before authorizing this transfer we have completed (or obtained from our sub-processors) a Privacy Impact Assessment (PIA), and we have confirmed that the protection offered is equivalent to what is offered in Quebec, by virtue of:

• Contractual data processing agreements (DPAs) with every sub-processor
• SOC 2 or ISO 27001 compliance commitments by the sub-processors
• Technical safeguards (encryption in transit and at rest, access controls, audit logging)

You may request a summary of the PIA applicable to your situation by contacting our privacy officer (§2).

07. Retention periods

We retain your information only as long as necessary for the purpose it was collected, or as long as required by law:

• Unconverted discovery call inquiries: 24 months after last contact
• Active client records: duration of the contractual relationship + 7 years (tax obligation)
• Payment and accounting records: 7 years (Quebec and Canadian tax law)
• Email communications: 36 months, then archived or deleted
• Web analytics (Plausible): kept in aggregated, anonymized form only; no identifiable data
• Website access logs: 90 days

After these periods, the information is securely destroyed or irreversibly anonymized.

08. Your rights

Under Law 25 and PIPEDA, you have the following rights:

• Access: obtain a copy of the personal information we hold about you
• Rectification: have inaccurate, incomplete, or outdated information corrected
• Deletion (de-indexation): request the erasure of your information when its retention is no longer justified
• Portability: receive your information in a structured, commonly used technological format (Law 25, art. 27)
• Withdrawal of marketing consent: stop receiving promotional communications at any time (see §11)

To exercise any of these rights, contact Matthieu Ruyssers at the contact details in §2. We respond within 30 days of receiving your request.

If you are not satisfied with our response, you may file a complaint with the Commission d'accès à l'information du Québec: cai.gouv.qc.ca.

09. Cookies and similar technologies

Our website uses:

• Essential cookies: required for the site to function (session, language preference). Cannot be disabled.
• Plausible Analytics: aggregated, anonymized web analytics, with no persistent cookies and no fingerprinting. No personal data is processed.

Our site does not use any advertising cookies, third-party tracking pixels, or marketing tags.

10. Security

We protect your information through the following measures:

• Encryption in transit (HTTPS/TLS) and at rest at our sub-processors
• Restricted access on the principle of least privilege
• Two-factor authentication required on every service account
• Annual sub-processor compliance review

In the event of a confidentiality incident, we notify the Commission d'accès à l'information within 72 hours of discovery, and notify affected individuals when the incident presents a serious risk (Law 25, art. 3.5).

11. Commercial communications (CASL)

In accordance with CASL, we send promotional messages (emails) only to those who have given prior express consent, or in the limited cases permitted by law (existing business relationship, for example).

Every promotional communication contains:

• Clear identification of the sender (Agence Alivro Inc.)
• Our contact details
• A working unsubscribe mechanism (unsubscribe link in the email)

Every unsubscribe request is honored within 10 business days of receipt, in accordance with CASL.

12. Changes to this policy

We may update this policy periodically to reflect regulatory, technical, or operational changes. The "last updated" date at the top of this page indicates the version in effect.

Significant changes (adding a new sub-processor, modifying purposes, changing retention periods) will be communicated to active clients and prospects by email at least 30 days before they take effect, except when a legal exception applies.

13. Contact

For any question, request, or complaint concerning this policy or the protection of your personal information:

If your request is not handled to your satisfaction, you may file a complaint with: